66d08c35739d9543c90d5621f4e6d04e41ccc980c054c75334523ad0a7ec94ab

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

514a883188158c93256ce993620e46fb_JaffaCakes118.html
Size

86KB
MD5

514a883188158c93256ce993620e46fb
SHA1

6016e584692edb2c541ac5ddbdeb1cbf1a4a8b3e
SHA256

66d08c35739d9543c90d5621f4e6d04e41ccc980c054c75334523ad0a7ec94ab
SHA512

94c457928ec0d0a71735fe3c7f3acbd3dd4ae9685aee01b14c43b7f09b4e12356f46738ed77324b983dc30f941505cb4aa519ee3ce848a2d83ce284625fcf1e4
SSDEEP

1536:f3PkSo3tRBOlDSCmbNncw/j4cLIE2IyoF:f3PkSo9LOlDSPbNncqqoF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
1616	msedge.exe
1616	msedge.exe
2376	identity_helper.exe
2376	identity_helper.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4052	1616	msedge.exe	84
PID 1616 wrote to memory of 4052	1616	msedge.exe	84
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 872	1616	msedge.exe	85
PID 1616 wrote to memory of 3304	1616	msedge.exe	86
PID 1616 wrote to memory of 3304	1616	msedge.exe	86
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87
PID 1616 wrote to memory of 1108	1616	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\514a883188158c93256ce993620e46fb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf1746f8,0x7ffdcf174708,0x7ffdcf174718
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7176 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8005022557922630352,2643496793647384778,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
a71855aaed7f81ab6a5db5676b9474ee

SHA1
1486888eb32b9e2d4feca0135c2e0c8c91c88aa1

SHA256
6df9935399692f8c314d1499044bb6a8524fc6278e93d181b96b40eceb652585

SHA512
f0e0dfe4c98e093cd5d3b64e3d62fbb76230d99a7f0f1b9bb4af2b3bfc7bad9ebc5d702dc44c6f4e9cfaaf1fd9708ea8b91a1ad2da5389240bd843729eaee432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
5eb385ca550d07dbdab6fa2120364ce9

SHA1
acf733fa1a47139b99a48737fa2d3b258760d68d

SHA256
0895e0ff4cdbee7b6aa6b41760c4b2c620ea7ce8f48dcb887e00994d626f5990

SHA512
2d6f1aa2eb3b9fac1b8e44b96fa89a2caad296dda526ae38224033bd09257d0e0cc8a112794b2941367eea03bfcaeb1d93a126a24560399d2acbd37ebcb4dcf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
163741408449a5e434813e8428b6dc35

SHA1
37e49efc49cba0011c544c586293a7612e14775d

SHA256
77175d23546fec93256482c72175c649347da59ef58c2aef0bb7d80d2efe2bf8

SHA512
96035518db3c86bb97da52b7dd3d4242b5bf33cc535cac5d96baf970ed170bae00439aebe2cf44ffc609896012d3fbe9d376ee9d7e167cb1c2bea4044f6e4601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
afb98dbae8694e7f35d663b5a14db092

SHA1
e159620f315d685c1cb524c9fb26293acd4126d9

SHA256
145504d8be2f69f55da23c556bedcc2a422f1ed21d75aca386ad468f8fa46bb8

SHA512
d71ef82de5c67ba5eaf92e3a6665611a6af74e17bc69bd1427ae730f31728b579fc921df72b953f3013aedb2e512e40b77a2ec2ebb2980b1957c4ee462c89e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
543f2b8efb16b037ce60662b02b8412a

SHA1
2041aaa43984201fea7e55598146c0060f0874d8

SHA256
f10e9d0600fd5252ca8804d2c566a935bb416de65577997f39a9dea071f0aab6

SHA512
f031431a681c259e353dfc2120c7d174f0e543829796790763c92704ab4adbac972dbe3571095f67d4fc3748596cb7beaf0a1eaf748df8f412db5f4b76b5e3c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c1589687cc0f1b789a90197ee9a313e3

SHA1
c81f9f9afa5d32e006416b57cfc914a8ae8547cb

SHA256
190748572fe8d554630e241216f1a5aa04661abd88fc5d0f61433202fdf9c905

SHA512
41e706339b85935d1bedf45757d23f1c672591e66e809eaa694d865cef53d90b8d015a453042ff9a69d8f90e188009f380480b24960bd53869c728d39d9e41a8

Download Submit